Dodgy download and spoofed job ad led to $6.3 billion Binance hack: attacker offered fake software and fake job to infiltrate company wallets and steal billions
I'm feeling fresh appreciation for my company's mandatory cybersecurity awareness course.
Following a malicious download, Binance, the world's largest cryptocurrency exchange, suffered a record-breaking $6.3 billion hack. Initial security measures were thwarted by a tampered Homebrew installation introduced via a search engine result. Following this, two additional steps were required to breach the company's security.
The first involved a software engineer contacted through a job-hunting platform by an apparently legitimate firm. The second step entailed a company wholly fabricated by the hacker to provide Engineer B with a malicious code repository, which, when installed, granted access to Engineer A's computer and another Wallet Software engineer.
By exploiting a container deployment permission token on Engineer A's machine, the attacker was able to infiltrate the wallets responsible for storing transitory exchange funds, culminating in a $6.3 billion theft.
Written by urgent.news from PC Gamer's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
- $6 billion Binance hack started with a fake job interview mashable.com
- Binance reveals hackers used fake job interviews, malicious code in $6 billion heist thehindu.com
- Binance Reveals How Hackers Stole $6 Billion propakistani.pk
- Coinbase says 99% of customer assets sit in cold storage after Binance’s $6.3 billion breach theblock.co
